Local admin account creation via plugin32.dll RDP backdoor

Ethan Andrews@eandrews

•updated Jul 16, 2026•10•0•18

Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.